Malicious PDF — malware analysis report

Static analysis result for SHA-256 a478845b87a7f9f5…

MALICIOUS

PDF

26.3 KB Authoring application: Solid Converter PDF
MD5: 0b553ccb4bf914caf6f544e8483196a7 SHA-1: f9400985cae845ab73f7b47f8bf6714405cb9af2 SHA-256: a478845b87a7f9f54e6bc193d0d4a19c7acb73ff8208b4de2adaff9b436c4acb
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic. This suggests the document's primary purpose is to redirect users to other sites, potentially for SEO manipulation or to host further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://biodanzacuerpoyalma.com/uploads/1/3/0/5/130551008/wevibe.pdf
    • http://poorcomics.com/uploads/1/3/0/7/130775282/8043949.pdf
    • http://optindeals.online/uploads/1/3/0/6/130621345/xajekawakev.pdf
    • http://www.aliciathoms.com/uploads/1/3/0/2/130270813/7288650.pdf
    • http://triplex-arrow.com/uploads/1/3/0/6/130639073/5560523.pdf
    • http://www.daytonbathrenovations.com/uploads/1/3/0/4/130483710/sagevalebu-pibazikef-zujam-kakepabode.pdf
    • http://martine-antoinette.com/uploads/1/3/0/7/130739968/6752039.pdf
    • http://notaria88qroo.com/uploads/1/3/0/6/130639404/36fa9be6a027a37.pdf
    • http://cpmiddleburg.com/uploads/1/3/0/5/130550732/703863cc3ad92bb.pdf
    • http://landscaperspasadena.com/uploads/1/3/0/5/130543032/fijowiti-fubijuxa-dubuxeritufekiz.pdf
    • http://emilyburdettphotography.com/uploads/1/3/0/7/130739595/sarabid_borasota.pdf
    • http://fethigurcan.org/uploads/1/3/0/6/130603942/06ec5de28c0.pdf
    • http://travisupshawtransport.com/uploads/1/3/0/8/130873942/4036426.pdf
    • http://www.goldstreamhatchery.org/uploads/1/3/0/5/130539131/3425164.pdf
    • http://agavepress.com/uploads/1/3/0/6/130621803/9700223.pdf
    • http://michaelparlato.com/uploads/1/3/0/5/130589135/9813973.pdf
    • http://paolofacchi.com/uploads/1/3/0/7/130739661/972282.pdf
    • http://therightdoor.com/uploads/1/3/0/6/130621666/8304690.pdf
    • http://askaccountancy.com/uploads/1/3/0/6/130620399/xozamowokawekeja.pdf
    • http://alpenroseconsulting.com/uploads/1/3/0/7/130775911/delijekopabole_jipudatizore.pdf
    • http://mta-sts.cafecarpenter.com.au/uploads/1/3/0/6/130604589/30b4182c5a83c.pdf
    • http://tatumshairstudio.com/uploads/1/3/0/5/130589217/eefb5e0320299c.pdf
    • http://inspiredwellnesssolutions.com/uploads/1/3/0/2/130291803/261c12be.pdf
    • http://lanzarote-immobilien.info/uploads/1/3/0/7/130776015/2252580.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000027e5.bin
9a2f692c90aa91d7f4ebeec0bf98f08b679bf4be2644d5698252cb031b1fa9bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27E5 8352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.